CVE-2025-71400 better-auth CVE debrief

Who should care

Defenders responsible for better-auth passkey deployments should assess exposure and prioritize verification and remediation efforts. This includes reviewing affected product or component, vulnerability class, likely operational impact, and source-confidence limits. Security teams and vulnerability management teams should also be aware of the potential risks associated with this vulnerability and take necessary actions to mitigate them.

Why it matters

CVE-2025-71400 is a high-severity vulnerability in better-auth passkey versions before 1.4.0 that allows authenticated users to delete arbitrary passkeys by ID. Defenders should prioritize verifying and upgrading to version 1.4.0 or later, and monitoring for suspicious delete-passkey endpoint activity.

• Authenticated users can delete arbitrary passkeys by ID
• Potential for unauthorized passkey deletion
• Need for verification and remediation

Technical summary

The better-auth passkey versions before 1.4.0 contain an insecure direct object reference vulnerability in the passkey deletion endpoint. This allows authenticated users to delete arbitrary passkeys by ID. The vulnerability can be exploited by submitting crafted requests to the delete-passkey endpoint with enumerated passkey IDs. Defenders should prioritize verifying and upgrading to version 1.4.0 or later, and monitoring for suspicious delete-passkey endpoint activity to mitigate potential risks associated with this vulnerability.

Defensive priority

Defenders should prioritize verifying and upgrading to version 1.4.0 or later, and monitoring for suspicious delete-passkey endpoint activity.

Recommended defensive actions

• Verify and upgrade to version 1.4.0 or later
• Monitor for suspicious delete-passkey endpoint activity
• Restrict access to the delete-passkey endpoint
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected deployments and potential impact is limited. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations. Compensating controls and monitoring for suspicious activity are also recommended.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.